http://shadowmite.com/wiki
-------------
And by all means, stop by the IRC chat links listed at my forum and thank rayban/kudgel who is making this possible with knowledge I still need to learn. So far he has customer code running in the bootloader (including on dead test phones) and is able to mount the rom store location, read/write serial/usb, and write to the framebuffer. We are well started toward a linux bootloader at this point also.

You don't need the new boot loader to go back to an old ROM. I looked around shadowmite.com a few weeks ago and came up with all the information to take my girlfriend's 650 running the latest ROW and downgrade it back to the current Cingular Rom. It took some work, to be sure, and about 3 or 4 hours in total to go from sitting down to find the tools until I had a completely downgraded treo. But there is enough information to put it all together there.

Further update: We have the 1st rom dump off of a 650 verifying the method. What's interesting is the zip files loaded in the updates are actually stored natively as zip files in the DOC partition... Shouldn't be long...

There are programs that can do that, but only for certain models. They're by a company called Brayder. The programs are JackFlash and JackSprat.

Unfortunately those "certain models" do not include the Treo 650. The Treo 650's "ROM" (that you "see") is really just the unzipped ROM image stored on the NVFS "disk," which is copied to RAM.

Regardless, it would be nice to be able to get to those files in the ROM-that's-really-RAM to add or delete files. Resco Locker comes tangentially close, by allowing apps to be locked into dbcache. But that is a far cry from what Jack used to do.

Personally, I'd like to remove/add apps from the ROM (in RAM). Should something go wrong, the ROM image is safely intact on the NVFS disk--and a hard-reset should bring it back to life. Obviously, this task would need to be aware of dbcache.